android.permission.READ_PHONE_STATE - Not required for debug or production.

android.permission.WRITE_EXTERNAL_STORAGE - Not required for debug or production.

android.permission.READ_EXTERNAL_STORAGE - Not required for debug or production.

Let's start by removing READ_PHONE_STATE, WRITE_EXTERNAL_STORAGE, and READ_EXTERNAL_STORAGE from both production and debug APKs, as it is not required in either. These storage permissions are still not needed if AsyncStorage module is in use, so it is safe to remove from both production and debug.

Open your android/app/src/main/AndroidManifest.xml file.

Even though these three permissions are not listed in the manifest they get added in. We add the three permissions with tools:node="remove" attribute, to make sure it gets removed during build. Note that the package identifier will be different, for below it is "com.myapp" because the project was created with react-native init myapp.

That's it. We did not remove the INTERNET permission as pretty much all apps use it. Now whenever you create a production APK all these 4 permissions will be removed. When you create a debug APK (react-native run-android) it will install the APK with only the three permissions removed, and SYSTEM_ALERT_WINDOW will remain.